In this post, I want to outline the risk methodologies presented in the book. Each will be paired with a brief description about them as well as what their abbreviations stand for.
NIST - "Risk Management guide to Information Technology Systems". Mostly used for computer systems and IT security issues.
FRAP - Facilitated Risk Analysis Process. Only focus on the risks that need the most attention. Goal is to save time and money. Only to be used to analyze one thing at a time.
OCTAVE - Operationally Critical Threat, Asset, and Vulnerability Evaluation. Used to look at all systems within an organization.
FMEA - Failure Modes and Effect Analysis. Uncovers flaws and the effects of these flaws.
CRAMM - Central Computing and Telecommunications Agency Risk Analysis and Management Method. This is the most generic approach in that it covers everything in risk analysis.
Tuesday, September 2, 2014
Chapter 2: IS Governance and Risk Management - Risk Assessment and Analysis
A risk assessment is used to identify risks and their potential impact. After completing it, it will help an organization identify where they need to put in security controls. It also helps with prioritization of the identified risks, and shows the analysis team which risks should be dealt with first. The third major thing that risk analysis accomplishes is that it will show a company what resources and how much of a particular resource should be used to protect against individual identified risks. Four main goals exist in information security risk analysis. First, you have got to identify your assets and what value they bring to the company or organization. Next, you find out what your potential threats are. After that you figure out what the probability of each of the threats occurring is. Finally you calculate what the cost of protecting against the threat will be, and determine if it is worth the resources you put in to protect each asset.
One term that I found while reading the section that I though was interesting was project sizing. I do not recall ever learning about this, so I thought it would be helpful to put it here...it simply means determining which assists and threats should be looked at prior to initiating risk analysis.
One term that I found while reading the section that I though was interesting was project sizing. I do not recall ever learning about this, so I thought it would be helpful to put it here...it simply means determining which assists and threats should be looked at prior to initiating risk analysis.
Chapter 2: IS Governance and Risk Management - Risk Management
Risks are everywhere. There is absolutely no such thing as no risk in any area of life. When it comes to information systems security, risks can be broken down into 7 main categories.
1. Physical damage
2. Human interaction
3. Equipment malfunction
4. Inside and outside attacks
5. Misuse of data
6. Loss of data
7. Application error
In order for a fitting risk management plan to be in place from a security standpoint, each of these categories must be analyzed. Then, potential damage should be calculated. Of course, you never really know how much damage not managing a certain risk will have on your organization until something bad actually occurs. The main objective here is to identify which risks are potentially more damaging, and then take precautions in that order.
1. Physical damage
2. Human interaction
3. Equipment malfunction
4. Inside and outside attacks
5. Misuse of data
6. Loss of data
7. Application error
In order for a fitting risk management plan to be in place from a security standpoint, each of these categories must be analyzed. Then, potential damage should be calculated. Of course, you never really know how much damage not managing a certain risk will have on your organization until something bad actually occurs. The main objective here is to identify which risks are potentially more damaging, and then take precautions in that order.
Chapter 2: IS Governance and Risk Management - Security Frameworks
The thing that I found the most interesting in this section of chapter two is the difference between enterprise and system architectures. I had never really thought about the similarities and differences of the two before reading this section and I feel as if it is pretty important to understand. Enterprise architecture is generally centered around an organization's structure. On the other hand, system architecture has to do with software and computing. I had been using these two terms kind of synonymously. Although they are not exactly the same thing, one supports the other in a direct fashion. Basically, an application for a business cannot be designed without first knowing how the business works and what the company wants the system to do. This is how the two architectures are intertwined, but are not the same thing like I had originally thought.
Chapter 2: IS Governance and Risk Management - Controls
There are three major control types: administrative, technical, and physical. Administrative controls (a.k.a. soft controls) are mostly management oriented. Common examples include security documentation, risk management, and training. Technical controls usually have to do with software and hardware. My two favorite examples of there types of controls are encryption and firewalls because I am familiar with both of these. Physical controls are exactly what they sound like. Security guards, cameras, locks and high fences with barbed-wire are examples of this last type of control.
The 6 control functionalities are as follows (most are self explanatory):
-Deterrent
-Preventative
-Corrective
-Recovery
-Detective
-Compensating -- Alternative control that provides similar protection as the original
Important for all controls to work together. If they do not do so in an effective manner, or if they contradict each other, security gaps will be prevalent.
The 6 control functionalities are as follows (most are self explanatory):
-Deterrent
-Preventative
-Corrective
-Recovery
-Detective
-Compensating -- Alternative control that provides similar protection as the original
Important for all controls to work together. If they do not do so in an effective manner, or if they contradict each other, security gaps will be prevalent.
Chapter 2: IS Governance and Risk Management - Security Definitions
I feel as is the best way for me to summarize this section of chapter two is to basically define all of the terms. This will be helpful if I ever decide to actually take the CISSP exam, as these security terms will be here for me to view.
1.) Vulnerability - No measure to counter potential attacks, or an inferior countermeasure is in place.
2.) Threat - Danger that is associated with a vulnerability.
3.) Threat Agent - An entity that takes advantage of a vulnerability.
4.) Risk - The probability of a threat agent exploiting a vulnerability and the associated impact.
5.) Control - Something that is put in place to reduce a risk. Also known as a countermeasure.
6.) Exposure - When a vulnerability is present that might expose one or more threats to an organization.
Figure 2-1 in the text gives a great graphical representation of how all of the above terms are connected and how they relate to one another.
1.) Vulnerability - No measure to counter potential attacks, or an inferior countermeasure is in place.
2.) Threat - Danger that is associated with a vulnerability.
3.) Threat Agent - An entity that takes advantage of a vulnerability.
4.) Risk - The probability of a threat agent exploiting a vulnerability and the associated impact.
5.) Control - Something that is put in place to reduce a risk. Also known as a countermeasure.
6.) Exposure - When a vulnerability is present that might expose one or more threats to an organization.
Figure 2-1 in the text gives a great graphical representation of how all of the above terms are connected and how they relate to one another.
Chapter 2: IS Governance and Risk Management - Fundamental Principles of Security
There are three main objectives of security.
- Integrity
-Availability
-Confidentiality
Integrity from a security perspective means that there is assurance that information provided by the system is reliable and accurate. This also means that modification that is unauthorized, or not supposed to happen, is prevented.
The second main objective, availability, means that authorized users are able to access their data and resources in a timely manner. Proper precautions should be in place that will prevent outsiders from affecting availability of data and resources.
Confidentiality refers to the goal of only allowing authorized individuals the ability to view and edit parts of the system that they should see. It should prevail while data is hanging out in a system, being moved around, as well as when it is received by another person or system.
All three are of equal importance and sort of "feed" off one another.
- Integrity
-Availability
-Confidentiality
Integrity from a security perspective means that there is assurance that information provided by the system is reliable and accurate. This also means that modification that is unauthorized, or not supposed to happen, is prevented.
The second main objective, availability, means that authorized users are able to access their data and resources in a timely manner. Proper precautions should be in place that will prevent outsiders from affecting availability of data and resources.
Confidentiality refers to the goal of only allowing authorized individuals the ability to view and edit parts of the system that they should see. It should prevail while data is hanging out in a system, being moved around, as well as when it is received by another person or system.
All three are of equal importance and sort of "feed" off one another.
Subscribe to:
Posts (Atom)